Maybe I'm missing something, but the nonce is labeled as not required:
nonce Bytes No A unique, random nonce
And later, as required (yet possibly just 0x):
The REQUIRED nonce field MUST include a random nonce. This field ensures that multiple (non-idempotent) invocations are unique. The nonce SHOULD be empty (0x) for Commands that are idempotent (such as deterministic Wasm modules or standards-abiding HTTP PUT requests).
That seems inconsistent.